From 13a822162225b5c99e98773b3ec68d739fe6b97c Mon Sep 17 00:00:00 2001 From: Christian Boltz Date: Mon, 8 Mar 2021 01:20:24 +0100 Subject: [PATCH] abstractions/ssl_certs: allow reading crypto policies See https://gitlab.com/redhat-crypto/fedora-crypto-policies for details. Reported by darix and also my own audit.log - the actual denial was for /usr/share/crypto-policies/DEFAULT/openssl.txt. Also allow the /etc/crypto-policies/ counterpart. (I'm aware that the crypto policies are not really certificates, but since they are used by several crypto libraries, ssl_certs is probably the best place for them even if the filename doesn't match.) --- profiles/apparmor.d/abstractions/ssl_certs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/profiles/apparmor.d/abstractions/ssl_certs b/profiles/apparmor.d/abstractions/ssl_certs index 57d0f41a2..b6ba6c0c7 100644 --- a/profiles/apparmor.d/abstractions/ssl_certs +++ b/profiles/apparmor.d/abstractions/ssl_certs @@ -41,5 +41,9 @@ /etc/certbot/archive/*/chain*.pem r, /etc/certbot/archive/*/fullchain*.pem r, + # crypto policies used by various libraries + /etc/crypto-policies/*/*.txt r, + /usr/share/crypto-policies/*/*.txt r, + # Include additions to the abstraction include if exists